Data Protection for an Israeli Company Selling to Europe: When the GDPR Applies, an EU Representative, the Adequacy Decision and Amendment 13

A Tel Aviv software company selling subscriptions in Germany, an online store in Israel whose shipments reach Romania, or a marketing company running targeted campaigns in France - all may be subject to the European Union's General Data Protection Regulation (GDPR), even without an office, employee or bank account in Europe. This guide explains when that happens, what the main obligations are, what the adequacy decision for Israel and Amendment 13 to the Protection of Privacy Law mean, and what to check. It is current as of November 2026.

1When does the GDPR apply to an Israeli company with no presence in Europe?

Under Article 3(2) of the GDPR, the Regulation applies to a body not established in the EU when the processing relates to one of two activities: offering goods or services to data subjects in the EU, whether paid or free, or monitoring their behaviour as far as that behaviour takes place within the EU.

2What are the main obligations when the GDPR applies?

The obligations are similar to those of a European company: a legal basis for every processing, transparency towards users, respecting their rights, data security and reporting security incidents. The main difference for a company outside the EU is the obligation to appoint a representative.

• Legal basis: each processing purpose needs a basis under Article 6 - consent, necessity for performance of a contract, a legal obligation, legitimate interest and others.
• Privacy policy: clear information on what is collected, why, how long it is kept, to whom it is transferred and what rights the user has.
• Data subject rights: access, rectification, erasure, restriction, portability and objection, with an internal process for responding on time.
• Record of processing activities under Article 30, subject to exemptions for small organisations.
• Security and incident notification: appropriate security measures, and in a security incident involving risk - notification to the supervisory authority within 72 hours, as a rule.
• Data transfers: a transfer from the EU to a third country requires a basis - an adequacy decision, standard contractual clauses or another mechanism.

3Does an Israeli company need an EU representative under Article 27?

Usually yes. Article 27 provides that where Article 3(2) applies, the controller or processor shall designate in writing a representative in the EU. The representative must be established in one of the Member States where the data subjects to whom the company offers services, or whom it monitors, are located.

• The exception: the obligation does not apply to processing that is occasional, does not include large-scale processing of special categories of data (such as health) or of data relating to convictions, and is unlikely to result in a risk to people's rights. A company that sells to Europe on an ongoing basis will usually find it hard to fall within the exception.
• The representative's role: an address for enquiries from supervisory authorities and data subjects, and maintaining the record of processing at the authority's request. It does not replace a data protection officer (DPO), whose appointment obligation is assessed separately.
• How to appoint: by a written agreement with the representative, and publish its details in the privacy policy.
• Liability: appointing a representative does not transfer the company's responsibility to it; the company remains responsible for compliance with the Regulation.

4What does the EU adequacy decision for Israel provide?

Commission Decision 2011/61/EU of January 2011 found that Israel provides an adequate level of protection for personal data transferred to it from the EU. On January 15, 2024 the Commission published its report on the first review of eleven older adequacy decisions, including Israel, and concluded that they continue to apply.

• What it eases: a European customer or partner can transfer personal data to a company in Israel without standard contractual clauses and without a separate transfer risk assessment, within the scope of the decision.
• What it does not do: it does not exempt the Israeli company from the GDPR when Article 3(2) applies, and does not cancel the representative obligation, the processing agreement or users' rights.
• Onward transfer: when the Israeli company transfers the data to a supplier in another third country, such as a cloud service in the US, a separate basis is needed for that transfer.
• Monitoring: the Commission announced that it will continue to monitor developments in the reviewed countries, and civil society organisations have called for the decision regarding Israel to be re-examined. It is worth following updates.

5What changed in Israel with Amendment 13 to the Protection of Privacy Law?

Amendment 13 to the Protection of Privacy Law, 5741-1981, was approved by the Knesset in August 2024 and took effect on August 14, 2025. It expanded the powers of the Privacy Protection Authority, including the power to impose financial sanctions, and established an obligation to appoint a privacy protection officer in certain bodies.

• Privacy protection officer: the Authority published guidelines, and the grace period for enforcing the appointment obligation ended on October 31, 2025. Whether the obligation applies to a particular company depends on the type and scale of its activity.
• Enforcement: the Authority announced that some sanctions may be imposed even without prior warning.
• Two systems in parallel: an Israeli company selling to Europe is subject to Israeli law for its entire database, and to the GDPR for its activity concerning people in the EU. GDPR compliance usually also makes it easier to comply with Israeli law, but the requirements are not identical, and each must be checked separately.

6What should a data processing agreement (DPA) with suppliers contain?

Every supplier that processes personal data on the company's behalf - a cloud service, CRM, mailing service, support centre - must sign a processing agreement that complies with Article 28. When the Israeli company is itself a supplier to a European customer, the customer will require such an agreement from it.

• Processing only on documented instructions from the controller, and for the specified purposes.
• A duty of confidentiality for staff exposed to the data.
• Appropriate security measures.
• Conditions for engaging a sub-processor, including prior authorisation or notice and an opportunity to object.
• Assisting the controller in responding to data subject requests and in notifying security incidents.
• Deleting or returning the data at the end of the engagement.
• Audit rights and providing the information needed to demonstrate compliance.

7What are the rules for cookies and tracking on the website?

For cookies that are not essential to the website's functioning - analytics, targeted advertising, social media pixels - prior consent from the user in the EU is generally required. The requirement stems from Article 5(3) of the ePrivacy Directive, which has been implemented in each country's national laws, so the details vary between countries.

• A consent banner that allows refusing as easily as accepting, without pre-ticked boxes.
• No loading of third-party tools before consent.
• A cookie policy listing the tools, purposes and retention periods.
• Recording consent and allowing it to be withdrawn.

8A checklist for an Israeli company selling to Europe

1. Map: what personal data is collected from people in the EU, where it is stored and to which suppliers it is passed.
2. Determine applicability: whether there is a targeted offer or monitoring, under Article 3(2).
3. Appoint an EU representative if the exception does not apply, and publish its details.
4. Check the DPO obligation under the GDPR and under Amendment 13 in Israel.
5. Update the privacy and cookie policies and install a consent mechanism.
6. Sign processing agreements with all suppliers, and check the basis for onward transfers outside Israel and the EU.
7. Prepare a security incident procedure that makes it possible to meet the notification deadline.
8. Prepare a process for responding to requests from data subjects.
9. Document the decisions, including a record of processing and impact assessments where required.

9What to check before entering the European market, and how we accompany it

Before launching a product or campaign in Europe, check whether the activity triggers the GDPR, which contracts with suppliers and customers are missing, and how GDPR compliance fits with the Israeli requirements after Amendment 13. We assist with the applicability analysis, reviewing and drafting processing agreements, terms of use and privacy policies, and coordinating with an EU representative and with technology and local advisers as needed.

More on this topic: An Israeli company doing business in Romania · A company abroad: comparison between countries · Doing business with an Israeli partner

Read next · 10 min readPermanent Establishment and a Remote Employee Abroad: When an Israeli Company Is Taxable in the Employee's Country, and What About Payroll and Social SecurityAn employee working from home abroad may create a permanent establishment for an Israeli company. Fixed place, dependent agent, building site, OECD 2025 home office update, payroll.Read the guide